System and method for insider threat detection

A computer readable storage device having instructions to cause a computer to implement a method identifying potentially malicious behavior, the method comprising:

• obtaining data related to accessing cyber assets and accessing physical assets from a combined cyber access and physical access control system that protects cyber and physical assets of an organization from both authorized and unauthorized access with malicious intent;
• apply machine learning algorithms to data from the cyber and physical access control system to build expected behavior models representative of expected behavior, the expected behavior models based on a context and a relationship of the data related to accessing cyber assets and accessing physical assets;
• comparing newly obtained data to known patterns of expected behavior as represented in the expected behavior models, the comparing including abstracting the newly obtained data to reduce a searching element of the comparing to a subset of a semantic graph representing the known patterns of expected behavior;
• identifying patterns of suspicious behavior as a function of comparing the data to the known patterns of expected behavior;
• and
• utilizing the comparison to identify potentially malicious insider behavior toward the cyber and physical assets.

A device comprising:

• an access control system to receive data regarding behavior involving accessing physical and cyber assets;
• a storage device storing an insider threat reference model that includes patterns of expected behavior, the patterns of expected behavior represented in stored expected behavior models representative of expected behavior, the expected behavior models based on a context and a relationship of the data related to accessing cyber assets and accessing physical assets and built by a plying machine learning algorithms to data from the access control system;
• an anomaly detector, to identify suspicious behaviors, that compares newly obtained data to the known patterns of expected insider behavior as represented in the expected behavior models, the comparing including abstracting the newly obtained data to reduce a searching element of the comparing to a subset of a semantic graph representing the known patterns of expected behavior;
• a reasoning engine that uses identified suspicious behavior to identify potentially malicious behaviors toward the cyber and physical assets.